EP3048757B1

EP3048757B1 - Authentication server testing method and system

Info

Publication number: EP3048757B1
Application number: EP14845212.1A
Authority: EP
Inventors: Ya'nan HU; Bianling Zhang; Qianjun SHI; Guobing Yuan
Original assignee: China Iwncomm Co Ltd
Current assignee: China Iwncomm Co Ltd
Priority date: 2013-09-17
Filing date: 2014-07-30
Publication date: 2019-06-26
Anticipated expiration: 2034-07-30
Also published as: CN103442383A; KR101816463B1; US10069816B2; US20160205090A1; EP3048757A4; EP3048757A1; JP2016533138A; JP6220075B2; CN103442383B; KR20160052662A; WO2015039498A1

Description

FIELD

The disclosure relates to the technical field of communications, and in particular to a method and a system for testing an authentication server.

BACKGROUND

Types of service based on the IP network become increasingly various, and involve national economy and all aspects of society. A wireless IP network transmits data via radio wave so that the openness of the physical network reaches a new level. Therefore, secure access has become a key issue for the safe operation of a wired network and a wireless network.
A secure access system of the IP network mainly includes three network entities: a network terminal, an access point and an authentication server. The network terminal makes a request of accessing a network to enjoy various resources provided by the network. The access point is an edge device of the IP interconnection network and an entity to provide access service to a network user. The authentication server is an entity to provide a service of user identity authentication.
National standard for a wireless local area network is promulgated and implemented in 2003, an authentication mechanism is implemented with a WAPI protocol, and then the broadband wireless IP standard working group promulgates an extended roaming protocol specification.
Currently, the testing system of a product certification protocol in a wireless local network field mainly includes an interoperability testing system of WI-FI alliance for IEEE802.11 standard. The system verifies the correctness of protocol implementation in a device to be tested by testing the communication performance and the interoperability between the device to be tested and a reference device, that is, the system tests a protocol conformance. The testing system has the following disadvantages: the completeness of testing the device is not high in a case that the device is tested in a typical application environment that is the interoperability of a higher layer protocol, and there may be deviation of a test result. The testing process is an interoperability testing which is similar to a black box testing, which only focuses on whether a final test result is successful; the testing process cannot be known, error location information in a case that the test is not passed cannot be given, and the accuracy of the test result may be affected seriously due to the correctness of the reference device implementation.
EP 1990972 A1 discloses a method for testing safety access protocol conformity to identification service entity. The method comprises following steps: checking whether certificates issued by identification service entity to be tested are conformed to specification or not; sending certificate identification request message to said entity by simulating identification applicant; capturing certificate identification response sent by said entity; gaining safety access protocol conformity test result by analyzing said certificate identification response.

SUMMARY

In order to solve the above-described technical issue, a method and a system for testing an authentication server are provided according to embodiments of the disclosure, which can be used to test an authentication server produced by equipment manufacturers for the correctness and the conformance of implementing a roaming authentication protocol, with which roaming authentication protocol data is sent to the authentication server to be tested by simulating an access point and the authentication server, response data sent by the authentication server to be tested is captured, and the response data is analyzed in detail, so as to ensure that a product passing the test fully complies with the provisions of the wireless local network national standard and the interoperability. The test result is accurate, test data is complete, and error location can be performed.
A method for testing an authentication server is provided according to the present disclosure, which includes:

installing a certificate of an authentication server to be tested in a monitor console and installing a certificate of the monitor console in the authentication server to be tested, wherein the installation is used to build a trust relationship between the monitor console and the authentication server to be tested;
constructing and sending, by the monitor console, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested, wherein the roaming authentication protocol data is constructed based on the certificate of the monitor console which is installed in the authentication server to be tested;
capturing, by the monitor console, response data sent by the authentication server to be tested, and performing, by the monitor console according to the installed certificate of the authentication server to be tested, comparative analysis to determine whether field information in the response data is consistent with locally stored respective information; and
displaying that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, displaying, by the monitor console, comparative analysis information.

A system for testing an authentication server is further provided according to the present disclosure, which includes:
a monitor console, including a certificate installation unit and a monitoring and processing unit, where

the certificate installation unit is configured to install a certificate of an authentication server to be tested, wherein a certificate of the monitor console is installed in the authentication server to be tested, and the installation is used to build a trust relationship between the monitor console and the authentication server to be tested;
the monitoring and processing unit is configured to construct and send, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested, wherein the roaming authentication protocol data is constructed based on the certificate of the monitor console which is installed in the authentication server to be tested; capture response data sent by the authentication server to be tested, and perform according to the installed certificate of the authentication server to be tested, comparative analysis to determine whether field information in the response data is consistent with the locally stored respective information; and display that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, the monitoring and processing unit displays comparative analysis information.

It can be seen from the above-described embodiments that, a method and a system for testing an authentication server are provided according to the embodiments of the present disclosure. A certificate of an authentication server to be tested is installed in a monitor console and a certificate of the monitor console is installed in the authentication server to be tested; the monitor console constructs and sends, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested; the monitor console captures response data sent by the authentication server to be tested, and performs comparative analysis to determine whether field information in the response data is consistent with locally stored respective information; and the monitor console displays that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, the monitor console displays comparative analysis information. It can be seen from the present disclosure, the monitor console sends the roaming authentication protocol data to the authentication server to be tested by simulating an access point and the authentication server, captures the response data sent by the authentication server to be tested, performs comparative analysis on the response data, determines whether the testing is successful, and displays the comparative analysis information in a case that the testing is unsuccessful, and thus error location can be performed accurately. Hence, compared with the conventional technology, the present disclosure has the following advantages: the related protocol data is captured and completely analyzed so that a test result is more accurate; a testing process includes a complete data capturing analysis, detailed information on the protocol data in the device to be tested may be given so that test data is more complete; and a microtest is performed on an execution process of the protocol so that an error in protocol implementation may be located accurately.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings to be used in the description of embodiments of the disclosure or the conventional technology are described briefly as follows, so that technical solutions according to the embodiments of the present disclosure or according to the conventional technology become clearer. It is apparent that the drawings in the following description only illustrate some embodiments of the present disclosure. For those skilled in the art, other drawings may be obtained according to these drawings without any creative work.

Figure 1 is a method flowchart of a method for testing an authentication server according to a first embodiment of the present disclosure;
Figure 2 is a method flowchart of a method for testing an authentication server according to a second embodiment of the present disclosure;
Figure 3 is a method flowchart of a method for testing an authentication server according to a third embodiment of the present disclosure;
Figure 4 is a method flowchart of a method for testing an authentication server according to a fourth embodiment of the present disclosure; and
Figure 5 is a system structure drawing of a system for testing an authentication server according to a sixth embodiment of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENTS

To make the above objects, features and advantages of the disclosure more apparent and easier to be understood, hereinafter specific embodiments of the disclosure are illustrated in detail in conjunction with the drawings.

First embodiment

Referring to Figure 1, Figure 1 is a method flowchart of a method for testing an authentication server according to a first embodiment of the present disclosure. The method includes steps 101 to 105.
In step 101, a certificate of an authentication server to be tested is installed in a monitor console and a certificate of the monitor console is installed in the authentication server to be tested. The installation is used to build a trust relationship between the monitor console and the authentication server to be tested.
In step 102, the monitor console constructs and sends roaming authentication protocol data to the authentication server to be tested, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol. The configuration type of the authentication server to be tested includes an home authentication server, an access authentication server and a center authentication server.
In step 103, the monitor console captures response data sent by the authentication server to be tested, and performs comparative analysis to determine whether field information in the response data is consistent with locally stored respective information.
In step 104, the monitor console displays that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information.
In step 105, the monitor console displays comparative analysis information in a case that the field information in the response data is not completely consistent with the locally stored respective information.
Preferably, the constructing and sending, by the monitor console, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested in step 102 may include:
constructing, by the monitor console, based on the configuration type of the authentication server to be tested, a roaming certificate authentication request message, or, constructing and sending, by the monitor console, a certificate authentication request message to the authentication server to be tested. The configuration type of the authentication server to be tested includes an home authentication server, an access authentication server and a center authentication server.
Preferably, the capturing, by the monitor console, response data sent by the authentication server to be tested, and performing, by the monitor console, comparative analysis to determine whether field information in the response data is consistent with locally stored respective information in step 103 may include:

capturing, by the monitor console, a roaming certificate authentication response message sent by the authentication server to be tested, or, capturing, by the monitor console, a roaming certificate authentication request message sent by the authentication server to be tested; and
performing, by the monitor console, comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with locally stored respective information, and/or, performing, by the monitor console, comparative analysis to determine whether field information in the roaming certificate authentication request message is consistent with locally stored respective information.

It can be seen from the above-described embodiment that, according to the present disclosure, the monitor console sends the roaming authentication protocol data to the authentication server to be tested by simulating an access point and the authentication server, captures the response data sent by the authentication server to be tested, performs comparative analysis on the response data, determines whether the testing is successful, and displays the comparative analysis information in a case that the testing is unsuccessful, and thus error location can be performed accurately. Hence, compared with the conventional technology, the present disclosure has the following advantages: the related protocol data is captured and completely analyzed so that a test result is more accurate; a testing process includes a complete data capturing analysis, detailed information on the protocol data in the device to be tested may be given so that test data is more complete; and a microtest is performed on an execution process of the protocol so that an error in protocol implementation may be located accurately.

Second embodiment

A method for testing an authentication server according to the present disclosure is explained with a specific application scenario. For the method for testing the authentication server, a method flowchart of a method for testing an authentication server as shown in Figure 2 may be referred to, in a case that the authentication server to be tested is configured to be an home authentication server. The method includes steps 201 to 205.
In step 201, the monitor console constructs and sends a roaming certificate authentication request message to the authentication server to be tested.
In step 202, the monitor console captures a roaming certificate authentication response message sent by the authentication server to be tested.
Preferably, the roaming certificate authentication request message may include: an identity of an authentication server (AS) trusted by a terminal, an authenticator entity (AE) inquiry, an authentication supplicant entity (ASUE) inquiry, a certificate of an authentication supplicant entity, a certificate of the authenticator entity, a certificate authentication result of the authenticator entity, a certificate of an access authentication service unit (ASU), an extended attribute, a message authentication and other fields, where the message authentication field is a signature by calculating a private key corresponding to a certificate of the monitor console which is installed in the authentication server to be tested.
In step 203, the monitor console performs comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with locally stored respective information.
Preferably, the roaming certificate authentication response message may include: an identity of an access authentication server, a verification result of a certificate, a server signature trusted by the authentication supplicant entity, the certificate of the access authentication service unit, a server signature trusted by the authentication supplicant entity, the extended attribute, the message authentication and other fields.
Preferably, step 203 may include:

checking, by the monitor console, whether a WLAN Authentication Infrastructure (WAI) version number of the roaming certificate authentication response message complies with the wireless local network national standard;
checking, by the monitor console, whether a name of an access AS in the roaming certificate authentication response message is consistent with a name of a holder of an access AS certificate which is installed in an AP;
performing comparative analysis, by the monitor console, to determine whether a field content of a terminal certificate of a field of a certificate verification result in the roaming certificate authentication response message is the same as content of locally stored terminal certificate, and checking whether a value of a code field of the verification result of a certificate of the terminal is valid;
performing comparative analysis, by the monitor console, to determine whether the certificate of the access ASU in roaming certificate authentication response message is the same as a certificate of the access ASU in the roaming certificate authentication request message sent by the monitor console;
performing comparative analysis, by the monitor console, to determine whether content of a certificate field in content of a message authentication field in the roaming certificate authentication response message is consistent with content of an AS certificate which is installed in the monitor console and trusted by the client; and
verifying, by the monitor console, whether a signature field of the content of the message authentication field in the roaming certificate authentication response message and a signature field ahead the message authentication field in the roaming certificate authentication response message are correct. The signature value is validated by using a public key of the installed certificate of an authentication server to be tested.

In step 204, the monitor console displays that the authentication server to be tested is tested successfully in a case that all the field information is consistent with the locally stored respective information.
In step 205, the monitor console displays comparative analysis information in a case that not all the field information is consistent with the locally stored respective information.
It can be seen from the above-described embodiment that, in a case that the authentication server to be tested is configured to be an home authentication server, the monitor console constructs and sends the roaming certificate authentication request message to the authentication server to be tested by simulating an AS, captures the roaming certificate authentication response message sent by the authentication server to be tested, and performs comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with the locally stored respective information. In this way of analyzing the response data, the test result is more accurate, test data is more complete, and error location can be performed accurately. The above-described testing method can ensure that a server passing the testing can fully comply with the wireless local network national standard and the interoperability.

Third embodiment

A method for testing an authentication server according to the present disclosure is explained with a specific application scenario. For the method for testing the authentication server, a method flowchart of a method for testing an authentication server as shown in Figure 3 may be referred to, in a case that the authentication server to be tested is configured to be an access authentication server. The method includes steps 301 to 308.
In step 301, a certificate of an authentication server to be tested is installed in a monitor console and a certificate of the monitor console is installed in the authentication server to be tested.
In step 302, the monitor console constructs and sends a certificate authentication request message to the authentication server to be tested.
In step 303, the monitor console captures a roaming certificate authentication request message sent by the authentication server to be tested.
In step 304, the monitor console performs comparative analysis to determine whether the roaming certificate authentication request message is consistent with locally stored respective information.
Preferably, step 304 may include: checking, by the monitor console, whether a WAI version number of the roaming certificate authentication request message complies with the wireless local network national standard;

performing comparative analysis, by the monitor console, to determine whether a name of an authentication server trusted by a terminal in the roaming certificate authentication request message is consistent with a name of a holder of a certificate of an authentication server which is installed in the monitor console and trusted by a terminal;
performing comparative analysis, by the monitor console, to determine whether a certificate of an STAasue in the roaming certificate authentication request message is consistent with a certificate of a terminal user which is installed in the monitor console;
performing comparative analysis, by the monitor console, to determine whether a certificate of an STAae in the roaming certificate authentication request message is consistent with a certificate of a user of an access point (AP) which is installed in the monitor console;
performing comparative analysis, by the monitor console, to determine whether a certificate of an access authentication server unit in the roaming certificate authentication request message is consistent with a certificate of an authentication service unit which is installed in the monitor console and trusted by the AP;
performing comparative analysis, by the monitor console, to determine whether a certificate field of a content field of a message authentication in the roaming certificate authentication request message is consistent with the certificate of the authentication service unit which is installed in the monitor console and trusted by the AP; and
verifying, by the monitor console, to determine whether a signature filed of the content field of the message authentication in the roaming certificate authentication request message and a field ahead the message authentication field in the roaming certificate authentication request message are correct.

In step 305, the monitor console constructs and sends a roaming certificate authentication response message to the authentication server to be tested in a case that all the field information is consistent with the locally stored respective information; otherwise, step 308 is executed.
In step 306, the monitor console captures the roaming certificate authentication response message sent by the authentication server to be tested, and performs comparative analysis to determine whether the field information in the certificate authentication response message is consistent with the locally stored respective information.
Preferably, the performing comparative analysis to determine whether field information in the certificate authentication response message is consistent with the locally stored respective information in step 306 may include:

checking, by the monitor console, whether a WAI version number of the certificate authentication response message complies with the wireless local network national standard;
performing comparative analysis, by the monitor console, to determine whether content of a terminal certificate field in a certificate authentication result information field in the certificate authentication response message is the same as content of locally stored terminal certificate, and checking whether a code field of a verification result of the terminal certificate is valid;
performing comparative analysis, by the monitor console, to determine whether content of an access point certificate field in the certificate authentication result information field in the certificate authentication response message is the same as content of locally stored access point certificate, and checking whether a code field of a verification result of the access point certificate is valid; and
verifying, by the monitor console, whether a signature field of a server trusted by an authenticator entity in the certificate authentication response message and a data field ahead the signature field are correct.

In step 307, the monitor console displays that the authentication server to be tested is tested successfully in a case that all the field information is consistent with the locally stored respective information.
In step 308, the monitor console displays comparative analysis information in a case that not all the field information is consistent with the locally stored respective information.
It can be seen from the above-described embodiment that, in a case that the authentication server to be tested is configured to be an access authentication server, the monitor console constructs the certificate authentication request message by simulating the access point, captures a roaming certificate authentication request message sent by the authentication server to be tested, performs comparative analysis to determine whether the field content of the roaming certificate authentication request message is consistent with the locally stored respective information. In a case that the field information is completely consistent with the locally stored respective information, the monitor console constructs and sends a roaming certificate authentication response message to the authentication server to be tested, captures the certificate authentication response message sent by the authentication server to be tested, and performs comparative analysis to determine whether the certificate authentication response message is consistent with the locally stored respective information. By performing comparative analysis on the response data in the authentication server to be tested twice, it is tested accurately whether the authentication server to be tested complies with the wireless local network national standard and the interoperability. In this way of analyzing the response data, the test result is more accurate, test data is more complete, and error location can be performed accurately.

Fourth embodiment

A method for testing an authentication server according to the present disclosure is explained with a specific application scenario. For the method for testing the authentication server, a method flowchart of a method for testing an authentication server as shown in Figure 4 may be referred to, in a case that the authentication server to be tested is configured to be a center authentication server. The method includes steps 401 to 408.
In step 401, a certificate of an authentication server to be tested is installed in a monitor console and a certificate of the monitor console is installed in the authentication server to be tested.
In step 402, the monitor console constructs and sends a roaming certificate authentication request message to the authentication server to be tested.
In step 403, the monitor console captures a roaming certificate authentication request message sent by the authentication server to be tested.
In step 404, the monitor console performs comparative analysis to determine whether field information in the captured roaming certificate authentication request message is consistent with the locally stored respective information.
Preferably, step 404 may include:

checking whether a WAI version number of the roaming certificate authentication request message complies with the wireless local network national standard;
performing comparative analysis to determine whether a name of an authentication server trusted by a terminal in the roaming certificate authentication request message is consistent with a name of a holder of a certificate of an authentication server which is installed in the monitor console and trusted by a terminal;
performing comparative analysis, by the monitor console, to determine whether an ADDID field in the roaming certificate authentication request message is consistent with an ADDID field in the roaming certificate authentication request message sent by the monitor console to the authentication server to be tested;
performing comparative analysis, by the monitor console, to determine whether an authenticator entity inquiry field in the roaming certificate authentication request message is consistent with an authenticator entity inquiry field in the roaming certificate authentication request message sent by the monitor console to the authentication server to be tested;
performing comparative analysis, by the monitor console, to determine whether an ASUE inquiry field in the roaming certificate authentication request message is consistent with an ASUE inquiry field in the roaming certificate authentication request message sent by the monitor console to the authentication server to be tested;
performing comparative analysis, by the monitor console, to determine whether a field of a certificate of an STAasue in the roaming certificate authentication request message is consistent with a certificate of a terminal user which is installed in the monitor console;
performing comparative analysis, by the monitor console, to determine whether the field of the certificate of the STAae in the roaming certificate authentication request message is consistent with a certificate of a user of an AP which is installed in the monitor console;
performing comparative analysis, by the monitor console, to determine whether an authentication result of the certificate of the STAae in the roaming certificate authentication request message is consistent with an authentication result of a certificate of an STAae in the roaming certificate authentication request message sent by the monitor console to the authentication server to be tested;
performing comparative analysis, by the monitor console, to determine whether a field of a certificate of an access ASU in the roaming certificate authentication request message is consistent with a certificate of an authentication server trusted by an AP which is installed in the monitor console; and
performing comparative analysis, by the monitor console, to determine whether a message authentication field in the roaming certificate authentication request message is consistent with a message authentication field in the roaming certificate authentication request message sent by the monitor console to the authentication server to be tested.

In step 405, the monitor console constructs and sends a roaming certificate authentication response message to the authentication server to be tested in a case that all the field information is consistent with the locally stored respective information; otherwise, step 408 is executed.
In step 406, the monitor console captures the roaming certificate authentication response message sent by the authentication server to be tested, and performs comparative analysis to determine whether the field information in the captured certificate authentication response message is consistent with the locally stored respective information.
Preferably, the step 406 may include:

checking, by the monitor console, whether a WAI version number of the roaming certificate authentication response message complies with the standard;
checking, by the monitor console, whether a name of an access authentication server in the roaming certificate authentication response message is consistent with a name of a holder of a certificate of an authentication server which is installed in the monitor console and trusted by an AP;
performing comparative analysis, by the monitor console, to determine whether an ADDID field in the roaming certificate authentication response message is consistent with an ADDID field in the roaming certificate authentication response message sent by the monitor console to the authentication server to be tested;
performing comparative analysis, by the monitor console, to determine whether a field of a certificate verification result in the roaming authentication response message is consistent with a field of a certificate verification result in the roaming authentication response message sent by the monitor console to the authentication server to be tested; and
performing comparative analysis, by the monitor console, to determine whether a field of a first signature of a server trusted by an authentication supplicant entity in the roaming certificate authentication response message is consistent with a field of a first signature of a server trusted by an authentication supplicant entity in the roaming certificate authentication response message sent by the monitor console to the authentication server to be tested.

The monitor console performs comparative analysis to determine whether a field of a certificate of an access ASU in the roaming certificate authentication response message is consistent with a certificate of an AS trusted by an AP which is installed in the monitor console.
The monitor console performs comparative analysis to determine whether a field of a second signature of a server trusted by an authentication supplicant entity in the roaming certificate authentication response message is consistent with a field of a second signature of a server trusted by an authentication supplicant entity in the roaming certificate authentication response message sent by the monitor console to the authentication server to be tested.
The monitor console performs comparative analysis to determine whether a message authentication field in the roaming certificate authentication response message is consistent with a message authentication field in the roaming certificate authentication response message sent by the monitor console to the authentication server to be tested.
In step 407, the monitor console displays that the authentication server to be tested is tested successfully in a case that all the field information is consistent with the locally stored respective information.
In step 408, the monitor console displays comparative analysis information in a case that not all the field information is consistent with the locally stored respective information.
It can be seen from the above-described embodiment that, in a case that the authentication server to be tested is configured to be the center authentication server, the monitor console constructs the roaming certificate authentication request message by simulating the access authentication server, captures a roaming certificate authentication request message sent by the authentication server to be tested, performs comparative analysis to determine whether the field content of the roaming certificate authentication request message is consistent with the locally stored respective information. In a case that the field information is completely consistent with the locally stored respective information, the monitor console constructs and sends a roaming certificate authentication response message to the authentication server to be tested, captures the roaming certificate authentication response message sent by the authentication server to be tested, and performs comparative analysis to determine whether the field content of in the roaming certificate authentication response message is consistent with the locally stored respective information. By performing comparative analysis on the response data in the authentication server to be tested twice, it is tested accurately whether the authentication server to be tested complies with the wireless local network national standard and the interoperability. In this way of analyzing the response data, the test result is more accurate, test data is more complete, and error location can be performed accurately.

Fifth embodiment

For the method for testing an authentication server according to the first embodiment, a system for testing an authentication server is provided according to the fifth embodiment, which includes:
a monitor console, including a certificate installation unit and a monitoring and processing unit, where

the certificate installation unit is configured to install a certificate of an authentication server to be tested;
the monitoring and processing unit is configured to construct and send, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested; capture response data sent by the authentication server to be tested, and perform comparative analysis to determine whether field information in the response data is consistent with the locally stored respective information; and display that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, the monitoring and processing unit displays comparative analysis information.

It can be seen from the above-described embodiment that, in the system for testing the authentication server according to the present disclosure, the monitor console sends, based on a configuration type of the authentication server to be tested, the roaming authentication protocol data to the authentication server to be tested by simulating an access point and the authentication server, the monitor console captures the response data sent by the authentication server to be tested, performs comparative analysis on the response data, determines whether the testing is successful, and displays the comparative analysis information in a case that the testing is unsuccessful, and thus error location can be performed accurately. Hence, compared with the conventional technology, the present disclosure has the following advantages: the related protocol data is captured and completely analyzed so that a test result is more accurate; a testing process includes a complete data capturing analysis, detailed information on the protocol data in the device to be tested may be given so that test data is more complete; and a microtest is performed on an execution process of the protocol so that an error in protocol implementation may be located accurately.

Sixth embodiment

To explain the system for testing the authentication server according to the present disclosure in detail, a system for testing an authentication server is further provided according to the sixth embodiment. Reference is made to a structural diagram of an authentication server system as shown in Figure 5, which includes a monitor console 501, a hub 502 and an authentication server to be tested 503, where the monitor console 501 and the authentication server to be tested 503 are connected to the hub 502. The monitor console 501 includes a certificate installation unit and a monitoring and processing unit. The certificate installation unit is configured to install a certificate of an authentication server to be tested. The monitoring and processing unit is configured to construct and send, based on a configuration type of the authentication server to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested; capture response data sent by the authentication server to be tested, and perform comparative analysis to determine whether field information in the response data is consistent with the locally stored respective information; and display that the authentication server to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, the monitoring and processing unit displays comparative analysis information.
The server to be tested includes a module configured to install a certificate of the monitor console.
The authentication server to be tested 503 is configured to send response data according to a roaming authentication protocol, based on the received roaming authentication protocol data.
Preferably, the monitoring and processing unit may include:

a constructing module configured to construct, based on the configuration type of the authentication server to be tested, a roaming certificate authentication request message, or, construct and send a certificate authentication request message to the authentication server to be tested,
where the configuration type of the authentication server to be tested includes an home authentication server, an access authentication server and a center authentication server;
a capturing module configured to capture a roaming certificate authentication response message sent by the authentication server to be tested, or, capture a roaming certificate authentication request message sent by the authentication server to be tested; and
a comparison module configured to perform comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with locally stored respective information, and/or, perform comparative analysis to determine whether field information in the roaming certificate authentication request message is consistent with the locally stored respective information.

Preferably, in a case that the authentication server to be tested is configured to be an home authentication server, the monitoring and processing unit may include:

a first constructing module configured to construct and send a roaming certificate authentication request message to the authentication server to be tested;
a first capturing module configured to capture a roaming certificate authentication response message sent by the authentication server to be tested;
a first comparison module configured to perform comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with the locally stored respective information; and
a first display module configured to display that the authentication server to be tested is tested successfully in a case that all the field information in the first comparison module is consistent with the locally stored respective information; otherwise, the first display module displays comparative analysis information.

Preferably, in a case that the authentication server to be tested is configured to be an access authentication server, the monitoring and processing unit may include:

a second constructing module configured to construct and send a certificate authentication request message to the authentication server to be tested;
a second capturing module configured to capture a roaming certificate authentication request message sent by the authentication server to be tested;
a second comparison module configured to perform comparative analysis to determine whether the roaming certificate authentication request message is consistent with the locally stored respective information;
a third constructing module configured to construct and send a roaming certificate authentication response message to the authentication server to be tested in a case that all the field information in the second comparison module is consistent with the locally stored respective information;
a third capturing module configured to capture a certificate authentication response message sent by the authentication server to be tested;
a third comparison module configured to perform comparative analysis to determine whether field information in the certificate authentication response message is consistent with the locally stored respective information; and
a second display module configured to display that the authentication server to be tested is tested successfully in a case that all the field information in the third comparison module is completely consistent with the locally stored respective information; otherwise, the second display module displays comparative analysis information.

Preferably, in a case that the authentication server to be tested is configured to be a center authentication server, the monitoring and processing unit may include:

a fourth constructing module configured to construct and send a roaming certificate authentication request message to the authentication server to be tested;
a fourth capturing module configured to capture a roaming certificate authentication request message sent by the authentication server to be tested;
a fourth comparison module configured to perform comparative analysis to determine whether field information in the captured roaming certificate authentication request message is consistent with the locally stored respective information;
a fifth constructing module configured to construct and send a roaming certificate authentication response message to the authentication server to be tested in a case that all the field information in the fourth comparison module is consistent with the locally stored respective information;
a fifth capturing module configured to capture a roaming certificate authentication response message sent by the authentication server to be tested;
a fifth comparison module configured to perform comparative analysis to determine whether field information in the captured roaming certificate authentication response message is consistent with the locally stored respective information; and
a third display module configured to display that the authentication server to be tested is tested successfully in a case that all the field information in the fifth comparison module is consistent with the locally stored respective information; otherwise, the third display module displays comparative analysis information.

Preferably, the server to be tested may include a module configured to install a certificate of the monitor console in a case that the monitor console tests the authentication server to be tested.
It can be seen from the above-described embodiment that, in the system for testing the authentication server according to the present disclosure, the monitor console sends the protocol data to the authentication server to be tested by simulating an access point, captures the response data sent by the authentication server to be tested, performs comparative analysis on the response data, determines whether the testing is successful, and displays the comparative analysis information in a case that the testing is unsuccessful, and thus error location can be performed accurately. In the system for testing the authentication server, the related protocol data is captured and completely analyzed so that a test result is more accurate; a testing process includes a complete data capturing analysis, detailed information on the protocol data in the device to be tested may be given so that test data is more complete; and a microtest is performed on an execution process of the protocol so that an error in protocol implementation may be located accurately.
It can be understood by those skilled in the art that all or a part of steps of the above-described embodiment methods may be realized by hardware which is instructed by a computer program. The program may be stored in a computer readable storage medium. The program may include the steps of the above-described method embodiments when being executed. The storage medium may include a magnetic disc, an optical disc, a read only memory (ROM), a random access memory (RAM) and so on.
It should be noted that the relationship terminologies such as "first", "second" and the like are only used herein to distinguish one entity or operation from another, rather than to necessitate or imply that an actual relationship or order exists between the entities or operations. Furthermore, terms of "include", "comprise" or any other variants are intended to be non-exclusive. Therefore, a process, method, article or device including a plurality of elements includes not only the disclosed elements but also other elements that are not clearly enumerated, or also include inherent elements of the process, method, article or device. Unless expressively limited otherwise, the statement "including a..." does not exclude the case that other similar elements may exist in the process, method, article or device other than enumerated elements.
The method and the system for testing an authentication server according to the embodiments of the disclosure are introduced in detail above, the principles and implementing ways of the disclosure are clarified with specific examples, and the above illustration of the embodiments is only intended to help to understand the method and core concept of disclosure. In addition, those skilled in the art may make some changes to the specific embodiments and the application scope based on the concept of the disclosure. In summary, the specification should not be construed as limiting the disclosure.

Claims

A method for testing an authentication server, comprising:
installing a certificate of an authentication server (503) to be tested in a monitor console (501) and installing a certificate of the monitor console (501) in the authentication server (503) to be tested, wherein the installation is used to build a trust relationship between the monitor console (501) and the authentication server (503) to be tested;

constructing and sending, by the monitor console (501), based on a configuration type of the authentication server (503) to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server (503) to be tested, wherein the roaming authentication protocol data is constructed based on the certificate of the monitor console (501) which is installed in the authentication server (503) to be tested;

capturing, by the monitor console, response data sent by the authentication server (503) to be tested, and performing, by the monitor console (501) according to the installed certificate of the authentication server (503) to be tested, comparative analysis to determine whether field information in the response data is consistent with locally stored respective information; and

displaying that the authentication server (503) to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, displaying, by the monitor console, comparative analysis information.
The method according to claim 1, wherein the constructing and sending, by the monitor console (501), based on a configuration type of the authentication server (503) to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server (503) to be tested comprises:
constructing, by the monitor console (501), based on the configuration type of the authentication server (503) to be tested, a roaming certificate authentication request message, or, constructing and sending, by the monitor console (501), a certificate authentication request message to the authentication server (503) to be tested, wherein the configuration type of the authentication server (503) to be tested comprises a home authentication server, an access authentication server and a center authentication server.
The method according to claim 1, wherein the capturing, by the monitor console (501), response data sent by the authentication server (503) to be tested, and performing, by the (501) monitor console, comparative analysis to determine whether field information in the response data is consistent with locally stored respective information comprises:
capturing, by the monitor console, a roaming certificate authentication response message sent by the authentication server (503) to be tested, or, capturing, by the monitor console (501), a roaming certificate authentication request message sent by the authentication server (503) to be tested; and

performing, by the monitor console, comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with locally stored respective information, and/or, performing, by the monitor console, comparative analysis to determine whether field information in the roaming certificate authentication request message is consistent with locally stored respective information.
The method according to claim 1, wherein in a case that the authentication server (503) to be tested is configured to be a home authentication server, the monitor console (501) constructs and sends a roaming certificate authentication request message to the authentication server (503) to be tested;
the monitor console captures a roaming certificate authentication response message sent by the authentication server (503) to be tested;
the monitor console (501) performs comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with the locally stored respective information; and
the monitor console displays that the authentication server (503) to be tested is tested successfully in a case that all the field information is consistent with the locally stored respective information; otherwise, the monitor console (501) displays comparative analysis information.
The method according to claim 1, wherein in a case that the authentication server to be tested is configured to be an access authentication server, the monitor console constructs and sends a certificate authentication request message to the authentication server (503) to be tested;
the monitor console (501) captures a roaming certificate authentication request message sent by the authentication server (503) to be tested;
the monitor console (501) performs comparative analysis to determine whether the roaming certificate authentication request message is consistent with the locally stored respective information;
the monitor console (501) constructs and sends a roaming certificate authentication response message to the authentication server (503) to be tested in a case that all the field information is consistent with the locally stored respective information;
the monitor console (501) captures a certificate authentication response message sent by the authentication server (503) to be tested, and performs comparative analysis to determine whether field information in the certificate authentication response message is consistent with the locally stored respective information; and
the monitor console (501) displays that the authentication server (503) to be tested is tested successfully in a case that all the field information is completely consistent with the locally stored respective information; otherwise, the monitor console (501) displays comparative analysis information.
The method according to claim 1, wherein in a case that the authentication server (503) to be tested is configured to be a center authentication server, the monitor console (501) constructs and sends a roaming certificate authentication request message to the authentication server (503) to be tested;
the monitor console (501) captures a roaming certificate authentication request message sent by the authentication server (503) to be tested;
the monitor console (501) performs comparative analysis to determine whether field information in the captured roaming certificate authentication request message is consistent with the locally stored respective information;
the monitor console (501) constructs and sends a roaming certificate authentication response message to the authentication server (503) to be tested in a case that all the field information is consistent with the locally stored respective information;
the monitor console (501) captures a roaming certificate authentication response message sent by the authentication server (503) to be tested;
the monitor console (501) performs comparative analysis to determine whether field information in the captured roaming certificate authentication response message is consistent with the locally stored respective information; and
the monitor console (501) displays that the authentication server (503) to be tested is tested successfully in a case that all the field information is completely consistent with the locally stored respective information; otherwise, the monitor console displays comparative analysis information.
A system for testing an authentication server, comprising:
a monitor console (501), comprising a certificate installation unit and a monitoring and processing unit, wherein
the certificate installation unit is configured to install a certificate of an authentication server (503) to be tested, wherein a certificate of the monitor console (501) is installed in the authentication server (503) to be tested, and the installation is used to build a trust relationship between the monitor console (501) and the authentication server (503) to be tested;

the monitoring and processing unit is configured to construct and send, based on a configuration type of the authentication server (503) to be tested, according to a roaming authentication protocol, roaming authentication protocol data to the authentication server to be tested, wherein the roaming authentication protocol data is constructed based on the certificate of the monitor console (501) which is installed in the authentication server (503) to be tested; capture response data sent by the authentication server (503) to be tested, and perform, according to the installed certificate of the authentication server to be tested, comparative analysis to determine whether field information in the response data is consistent with the locally stored respective information; and display that the authentication server (503) to be tested is tested successfully in a case that the field information in the response data is completely consistent with the locally stored respective information; otherwise, the monitoring and processing unit displays comparative analysis information.
The system according to claim 7, wherein the monitoring and processing unit comprises:
a constructing module configured to construct, based on the configuration type of the authentication server (503) to be tested, a roaming certificate authentication request message, or, construct and send a certificate authentication request message to the authentication server (503) to be tested, wherein the configuration type of the authentication server (503) to be tested comprises a home authentication server, an access authentication server and a center authentication server;

a capturing module configured to capture a roaming certificate authentication response message sent by the authentication server (503) to be tested, or, capture a roaming certificate authentication request message sent by the authentication server (503) to be tested; and

a comparison module configured to perform comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with locally stored respective information, and/or, perform comparative analysis to determine whether field information in the roaming certificate authentication request message is consistent with the locally stored respective information.
The system according to claim 7, wherein in a case that the authentication server (503) to be tested is configured to be a home server, the monitoring and processing unit comprises:
a first constructing module configured to construct and send a roaming certificate authentication request message to the authentication server (503) to be tested;

a first capturing module configured to capture a roaming certificate authentication response message sent by the authentication server to be tested;

a first comparison module configured to perform comparative analysis to determine whether field information in the roaming certificate authentication response message is consistent with the locally stored respective information; and

a first display module configured to display that the authentication server (503) to be tested is tested successfully in a case that all the field information in the first comparison module is consistent with the locally stored respective information; otherwise, the first display module displays comparative analysis information.
The system according to claim 7, wherein in a case that the authentication server to be tested is configured to be an access authentication server, the monitoring and processing unit comprises:
a second constructing module configured to construct and send a certificate authentication request message to the authentication server (503) to be tested;

a second capturing module configured to capture a roaming certificate authentication request message sent by the authentication server (503) to be tested;

a second comparison module configured to perform comparative analysis to determine whether the roaming certificate authentication request message is consistent with the locally stored respective information;

a third constructing module configured to construct and send a roaming certificate authentication response message to the authentication server to be tested in a case that all the field information in the second comparison module is consistent with the locally stored respective information;

a third capturing module configured to capture a certificate authentication response message sent by the authentication server to be tested;

a third comparison module configured to perform comparative analysis to determine whether field information in the certificate authentication response message is consistent with the locally stored respective information; and

a second display module configured to display that the authentication server (503) to be tested is tested successfully in a case that all the field information in the third comparison module is completely consistent with the locally stored respective information; otherwise, the second display module displays comparative analysis information.
The system according to claim 7, wherein in a case that the authentication server to be tested is configured to be a center authentication server, the monitoring and processing unit comprises:
a fourth constructing module configured to construct and send a roaming certificate authentication request message to the authentication server (503) to be tested;

a fourth capturing module configured to capture a roaming certificate authentication request message sent by the authentication server (503) to be tested;

a fourth comparison module configured to perform comparative analysis to determine whether field information in the captured roaming certificate authentication request message is consistent with the locally stored respective information;

a fifth constructing module configured to construct and send a roaming certificate authentication response message to the authentication server (503) to be tested in a case that all the field information in the fourth comparison module is consistent with the locally stored respective information;

a fifth capturing module configured to capture a roaming certificate authentication response message sent by the authentication server (503) to be tested;

a fifth comparison module configured to perform comparative analysis to determine whether field information in the captured roaming certificate authentication response message is consistent with the locally stored respective information; and

a third display module configured to display that the authentication server to be tested is tested successfully in a case that all the field information in the fifth comparison module is consistent with the locally stored respective information; otherwise, the third display module displays comparative analysis information.
The system according to any one of claims 7 to 11, wherein the server (503) to be tested comprises a module configured to install a certificate of the monitor console in a case that the monitor console tests the authentication server (503) to be tested.